feat(ubuntu): match FIPS packages against the dedicated FIPS bucket - #66
Open
Bit-Doctor wants to merge 1 commit into
Open
feat(ubuntu): match FIPS packages against the dedicated FIPS bucket#66Bit-Doctor wants to merge 1 commit into
Bit-Doctor wants to merge 1 commit into
Conversation
Ubuntu ships FIPS-validated packages (e.g. openssl) fixed on its FIPS
streams (fips/, fips-updates/, fips-preview/). trivy-db now stores those
advisories in a dedicated "<version>-FIPS" bucket instead of the regular
release bucket, so FIPS and non-FIPS fixed versions no longer collide.
Detect FIPS packages by the FIPS version marker Ubuntu adds
("+Fips"/"+fips", or ".fips.") and, for those packages, query the
"<version>-FIPS" bucket. Non-FIPS packages keep querying the regular
release bucket, so FIPS-validated fixes are shown only to FIPS users and
non-FIPS users are unaffected.
Companion trivy-db change: DataDog/trivy-db#60
Upstream discussion: aquasecurity/trivy-db#664
Co-authored-by: Cursor <cursoragent@cursor.com>
LucasChevrierGit
approved these changes
Jul 30, 2026
LucasChevrierGit
left a comment
LucasChevrierGit
left a comment
There was a problem hiding this comment.
Just one comment, otherwise LGTM. ✅
Comment on lines
+106
to
114
| release := s.versionFromEolDates(ctx, osVer) | ||
|
|
||
| var vulns []types.DetectedVulnerability | ||
| for _, pkg := range pkgs { | ||
| // Skip third-party packages as they are not covered by Ubuntu security advisories | ||
| if pkg.Repository.Class == ftypes.RepositoryClassThirdParty { | ||
| continue | ||
| } | ||
|
|
There was a problem hiding this comment.
release can be ESM-suffixed (e.g. "18.04-ESM"), so pkgRelease += "-FIPS" produces "18.04-ESM-FIPS" — a bucket that doesn't exist. Hosts with both esm-infra and FIPS enabled would silently get zero FIPS results. Build the FIPS bucket off the base release instead:
Suggested change
| release := s.versionFromEolDates(ctx, osVer) | |
| var vulns []types.DetectedVulnerability | |
| for _, pkg := range pkgs { | |
| // Skip third-party packages as they are not covered by Ubuntu security advisories | |
| if pkg.Repository.Class == ftypes.RepositoryClassThirdParty { | |
| continue | |
| } | |
| release := s.versionFromEolDates(ctx, osVer) | |
| baseRelease := strings.TrimSuffix(release, "-ESM") | |
| var vulns []types.DetectedVulnerability | |
| for _, pkg := range pkgs { | |
| // Skip third-party packages as they are not covered by Ubuntu security advisories | |
| if pkg.Repository.Class == ftypes.RepositoryClassThirdParty { | |
| continue | |
| } | |
| // FIPS advisories live in a "<base-version>-FIPS" bucket ("-ESM" and | |
| // "-FIPS" never combine), so strip any "-ESM" suffix first. | |
| pkgRelease := release | |
| if isFIPSPackage(pkg) { | |
| pkgRelease = baseRelease + "-FIPS" | |
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Make the Ubuntu detector query a dedicated FIPS advisory bucket for FIPS-validated packages.
Ubuntu ships FIPS-validated packages (e.g.
openssl) that are fixed on its FIPS streams (fips/,fips-updates/,fips-preview/). The companion trivy-db change stores those advisories in a dedicatedubuntu <version>-FIPSbucket instead of the regular release bucket, so FIPS and non-FIPS fixed versions no longer collide.This PR teaches the scanner to:
+Fips/+fips, or.fips.), and<version>-FIPSbucket; non-FIPS packages keep querying the regular release bucket.As a result FIPS-validated fixes are shown only to FIPS users, and non-FIPS users are unaffected.
Changes
pkg/detector/ospkg/ubuntu/ubuntu.go-FIPSwhenisFIPSPackage(pkg)before callingVulnSrc.Get.isFIPSPackagehelper (checks binary and source version strings, case-insensitive).pkg/detector/ospkg/ubuntu/ubuntu_test.go: add a FIPS-package case (matched inubuntu 20.04-FIPS) and a non-FIPS case (must not match the FIPS bucket).testdata/fixtures/{ubuntu,data-source}.yaml: add anubuntu 20.04-FIPSbucket + data source.No
go.modbump is required: the scanner only changes the bucket-name string passed toGet. The real-FIPSbuckets are produced by the companion trivy-db PR once the DB is rebuilt.Companion PR
References
Testing
go test ./pkg/detector/ospkg/ubuntu/...passes.Made with Cursor